CVE-2020-25391

CSZ CMS 1.2.9 is affected by a cross-site scripting (XSS) vulnerability allowing arbitrary web script/HTML execution via a crafted payload in the New Pages field of the Pages Content module. The CVE-2020-25391 entry is corroborated by multiple sources (NVD, Red Hat advisory, CNVD, CVE list) and l...

CVE-2020-25394

The connected records confirm CVE-2020-25394 affects moziloCMS 2.0 with a stored XSS via the Content parameter. Authenticated users can inject web scripts/HTML, enabling arbitrary script execution in the context of the affected web app. The vulnerability is described consistently across CVE/NVD a...

CVE-2020-35986

The connected Nuclei template and multiple references confirm CVE-2020-35986 is a stored XSS in the Rukovoditel Web App (version

Cisco BPA, WSA Bugs Allow Remote Cyberattacks

A set of high-severity privilege-escalation vulnerabilities affecting Business Process Automation BPA application and Cisco’s Web Security Appliance WSA and could allow authenticated, remote attackers to access sensitive data or take over a targeted system. The first two bugs CVE-2021-1574 and...

CVE-2021-1359

A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to perform command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied XML input for the...

CVE-2021-1359

A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to perform command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied XML input for the...

Command injection

A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to perform command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied XML input for the...

CVE-2021-1359 Cisco Web Security Appliance Privilege Escalation Vulnerability

A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to perform command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied XML input for the...

CVE-2021-1359

CVE-2021-1359 affects Cisco AsyncOS Web Security Appliance (WSA) in the configuration management path. The issue arises from insufficient validation of user-supplied XML input in the web interface, allowing an authenticated, remote attacker with a valid account to upload crafted XML configuration...

CVE-2021-1359 Cisco Web Security Appliance Privilege Escalation Vulnerability

A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to perform command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied XML input for the...

Cisco Releases Security Updates for Multiple Products

Cisco has released security updates to address vulnerabilities in multiple Cisco products. An attacker could exploit some of these vulnerabilities to take control of an affected system. For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page. CISA encourages...

Cisco Web Security Appliance Privilege Escalation Vulnerability

A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to perform command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied XML input for the...

WordPress 代码问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports the hosting of personal blog sites on servers with PHP and MySQL.The WordPress ProfilePress plugin is vulnerable to arbitrary file uploads, which can be exploited...

Cisco Web Security Appliance 安全漏洞

The Cisco Web Security Appliance WSA is a web security appliance from Cisco USA. The appliance provides SaaS-based access control, real-time web reporting and tracking, and security policy formulation. A security vulnerability exists in the Cisco Web Security Appliance that stems from a flaw in t...

CVE-2021-34190

CVE-2021-34190 is a stored XSS vulnerability in Issabel PBX version 4. The issue occurs in index.php?menu=billing_rates where an attacker can inject arbitrary web scripts/HTML via crafted payloads entered into the Name or Prefix fields under the Create New Rate module. Connected sources confirm t...

CVE-2020-36416

Summary: CVE-2020-36416 is a stored XSS vulnerability in CMS Made Simple 2.2.14. An authenticated attacker can inject arbitrary web scripts/HTML through the “Create a new Design” field in the Designs module. The issue is corroborated by multiple feeds (Red Hat, NVD, CNVD, PRION/OpenVAS, CVE listi...

CVE-2020-36414

CMS Made Simple is affected by a stored XSS in version 2.2.14 via crafted payloads entered in the Add Article feature (URL slug or Extra fields). The vulnerability requires authentication and could allow executing arbitrary scripts/HTML in the victim’s browser. Publicly documented fixes point to ...

CVE-2020-36411

CMS Made Simple 2.2.14 contains a stored XSS vulnerability exploited via crafted input in the Path for the {page_image} tag: and Path for thumbnail field: parameters in the Content Editing Settings module. The issue permits authenticated users to inject and execute arbitrary web scripts/HTML in t...

CVE-2020-36399

CVE-2020-36399 describes a stored cross-site scripting (XSS) vulnerability in phplist versions 3.5.4 and earlier, exploitable via a crafted payload in the “rule1” parameter under the “Bounce Rules” module. All connected sources corroborate that the issue is a client-side scripting vulnerability t...

CVE-2020-36396

The CVE refers to LavaLite 5.8.0, specifically a stored XSS in the /admin/roles/role component. An authenticated attacker can inject arbitrary web scripts/HTML via the New parameter, enabling script execution in the context of the logged-in user. The provided connected documents confirm the vulne...